Specifications:
* QCA9557, 16 MiB Flash, 128 MiB RAM, 802.11n 2T2R
* QCA9882, 802.11ac 2T2R
* Gigabit LAN Port (AR8035), 802.11af PoE
Installation:
* Factory Web UI is at 192.168.0.50
login with 'admin' and blank password, flash factory.bin
* Recovery Web UI is at 192.168.0.50
connect network cable, hold reset button during power-on and keep it
pressed until uploading has started (only required when checksum is ok,
e.g. for reverting back to oem firmware), flash factory.bin
After flashing factory.bin, additional free space can be reclaimed by
flashing sysupgrade.bin, since the factory image requires some padding
to be accepted for upgrading via OEM Web UI.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
Device specifications:
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 2
+ used as LAN interface
* 12-24V 1A DC
* external antennas
Flashing instructions:
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Device specifications:
* Qualcomm/Atheros QCA9533 v2
* 650/600/217 MHz (CPU/DDR/AHB)
* 64 MB of RAM
* 16 MB of SPI NOR flash (mx25l12805d)
- 2x 7 MB available; but one of the 7 MB regions is the recovery image
* 2x 10/100 Mbps Ethernet
* 2T2R 2.4 GHz Wi-Fi
* multi-color LED (controlled via red/green/blue GPIOs)
* 1x GPIO-button (reset)
* external h/w watchdog (enabled by default)
* TTL pins are on board (arrow points to VCC, then follows: GND, TX, RX)
* 2x fast ethernet
- eth0
+ Label: Ethernet 1
+ 24V passive POE (mode B)
+ used as WAN interface
- eth1
+ Label: Ethernet 2
+ 802.3af POE
+ builtin switch port 2
+ used as LAN interface
* 12-24V 1A DC
* internal antennas
Flashing instructions:
The tool ap51-flash (https://github.com/ap51-flash/ap51-flash) should be
used to transfer the factory image to the u-boot when the device boots up.
Signed-off-by: Sven Eckelmann <sven@narfation.org>
FCC ID: A8J-ECB350
Engenius ECB350 v1 is an indoor wireless access point with a gigabit ethernet port,
2.4 GHz wireless, external antennas, and PoE.
**Specification:**
- AR7242 SOC
- AR9283 WLAN 2.4 GHz (2x2), PCIe on-board
- AR8035-A switch RGMII, GbE with 802.3af PoE
- 40 MHz reference clock
- 8 MB FLASH 25L6406EM2I-12G
- 32 MB RAM
- UART at J2 (populated)
- 2 external antennas
- 3 LEDs, 1 button (power, lan, wlan) (reset)
**MAC addresses:**
MACs are labeled as WLAN and WAN
vendor MAC addresses in flash are duplicate
phy0 WLAN *:b8 ---
eth0 WAN *:b9 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9f670000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
otherwise, uboot-env can be used to make uboot load the failsafe image
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt
ssh into openwrt and run
`fw_setenv rootfs_checksum 0`
reboot, wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of ECB350 v1 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
The factory upgrade script follows the original mtd partitions.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For AR724x series, the PLL register for GMAC0
can be seen in the DTSI as 0x2c.
Therefore the PLL register can be read from u-boot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x1805002c 1`
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board no extra adjustements are needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Add support for the ar71xx supported GL.iNet GL-USB150 to ath79.
GL.iNet GL-USB150 is an USB dongle WiFi router, based on Atheros AR9331.
Specification:
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of FLASH (SPI NOR)
- Realtek RTL8152B USB to Ethernet bridge (connected with AR9331 PHY4)
- 1T1R 2.4 GHz
- 2x LED, 1x button
- UART header on PCB
Flash instruction:
Vendor software is based on openwrt so you can flash the sysupgrade
image via the vendor GUI or using command line sysupgrade utility.
Make sure to not save configuration over reflash as uci settings
differ between versions.
Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
factory.bin was not tested for ECB1750...
but it was tested on it's sister board ECB1200
The product ID for the header can be verified by inspecting
the header of OEM images, or in the u-boot environment.
Also:
- the LAN LED is controlled directly by the AR8035 switch
- the labelled (first increment) MAC for both is ethaddr (eth0)
- list packages in alphabetical order
- use default sysupgrade.bin recipe
Signed-off-by: Michael Pratt <mcpratt@pm.me>
FCC ID: A8J-ECB1200
Engenius ECB1200 is an indoor wireless access point with a GbE port,
2.4 GHz and 5 GHz wireless, external antennas, and 802.3af PoE.
**Specification:**
- QCA9557 SOC MIPS, 2.4 GHz (2x2)
- QCA9882 WLAN PCIe card, 5 GHz (2x2)
- AR8035-A switch RGMII, GbE with 802.3af PoE, 25 MHz clock
- 40 MHz reference clock
- 16 MB FLASH 25L12845EMI-10G
- 2x 64 MB RAM 1538ZFZ V59C1512164QEJ25
- UART at JP1 (unpopulated, RX shorted to ground)
- 4 external antennas
- 4 LEDs, 1 button (power, eth, wifi2g, wifi5g) (reset)
**MAC addresses:**
MAC Addresses are labeled as ETH and 5GHZ
U-boot environment has the vendor MAC addresses
MAC addresses in ART do not match vendor
eth0 ETH *:5c u-boot-env ethaddr
phy0 5GHZ *:5d u-boot-env athaddr
---- ---- ???? art 0x0/0x6
**Installation:**
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
(see TFTP recovery)
perform a sysupgrade
**Serial Access:**
the RX line on the board for UART is shorted to ground by resistor R176
therefore it must be removed to use the console
but it is not necessary to remove to view boot log
optionally, R175 can be replaced with a solder bridge short
the resistors R175 and R176 are next to the UART pinout at JP1
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
Unlike most Engenius boards, this does not have a 'failsafe' image
the only way to return to OEM is TFTP or serial access to u-boot
**TFTP recovery:**
Unlike most Engenius boards, TFTP is reliable here
rename initramfs-kernel.bin to 'ap.bin'
make the file available on a TFTP server at 192.168.1.10
power board while holding or pressing reset button repeatedly
or with serial access:
run `tftpboot` or `run factory_boot` with initramfs-kernel.bin
then `bootm` with the load address
**Format of OEM firmware image:**
The OEM software of ECB1200 is a heavily modified version
of Openwrt Altitude Adjustment 12.09.
This Engenius board, like ECB1750, uses a proprietary header
with a unique Product ID. The header for factory.bin is
generated by the mksenaofw program included in openwrt.
**Note on PLL-data cells:**
The default PLL register values will not work
because of the AR8035 switch between
the SOC and the ethernet port.
For QCA955x series, the PLL registers for eth0 and eth1
can be see in the DTSI as 0x28 and 0x48 respectively.
Therefore the PLL registers can be read from uboot
for each link speed after attempting tftpboot
or another network action using that link speed
with `md 0x18050028 1` and `md 0x18050048 1`.
However the registers that u-boot sets are not ideal and sometimes wrong...
the at803x driver supports setting the RGMII clock/data delay on the PHY side.
This way the pll-data register only needs to handle invert and phase.
for this board clock invert is needed on the MAC side
all link speeds functional
Signed-off-by: Michael Pratt <mcpratt@pm.me>
The flash capacity is divided in two flash chips and currently only
first is used. Increase available space for OpenWrt by additional 16 MiB
using mtd-concat driver. Because U-Boot might not be able to load kernel
image spanned through two flash chips, the size of kernel is limited
to space available on first first chip.
Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
AirTight Networks (later renamed to Mojo Networks) C-75 is a dual-band
access point, also sold by WatchGuard under name AP320.
Specification
SoC: Qualcomm Atheros QCA9550
RAM: 128 MiB DDR2
Flash: 2x 16 MiB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9890 oversized Mini PCIe card
Ethernet: 2x 10/100/1000 Mbps QCA8334
port labeled LAN1 is PoE capable (802.3at)
USB: 1x 2.0
LEDs: 7x which two are GPIO controlled, four switch controlled, one
controlled by wireless driver
Buttons: 1x GPIO controlled
Serial: RJ-45 port, Cisco pinout
baud: 115200, parity: none, flow control: none
JTAG: Yes, pins marked J1 on PCB
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to one of LAN ports.
3. Connect to serial port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
6. Wait about 1 minute for OpenWrt to boot.
7. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
8. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Known issues
Green power LED does not work.
Additional information
The U-Boot fails to initialise ethernet ports correctly when a UART
adapter is attached to UART pins (marked J3 on PCB).
Cc: Vladimir Georgievsky <vladimir.georgievsky@yahoo.com>
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
This device has (almost?) identical hardware to the F9J1108 v2 but uses
a different firmware magic and model number.
Specifications:
SoC: QCA9558
CPU: 720 MHz
Flash: 16 MiB NOR
RAM: 128 MiB
WiFi 2.4 GHz: QCA9558-AT4A 3x3 MIMO 802.11b/g/n
WiFi 5 GHz: QCA9880-2R4E 3x3 MIMO 802.11a/n/ac
Ethernet: 4x LAN and 1x WAN (all 1Gbit/s ports)
USB: 1 x USB 2.0 (lower), 1 x USB 3.0 (upper)
MAC addresses based on OEM firmware:
Interface Address Location
--------- ------- --------
lan *:5A sometimes in 0x6
wan *:5B 0x0
2.4Ghz *:5A 0x1002
5Ghz As per mini PCIe EEPROM
Flashing instructions:
The factory.bin can be flashed via the Belkin web UI or via the uboot
HTTP upgrade page (which is by default listening on 192.168.2.1). Once
the factory.bin has been written, sysupgrade.bin will work as usual.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Belkin F9J1108 v2 and F9K1115 v2 are (seemingly) identical hardware
with different model numbers. Extract all non-device specific code to a
common .dtsi so it can be re-used when adding support for the
F9K1115 v2.
Similar to the .dtsi most of the image building recipe code can be
re-used. Move everything except the device model, edimax header magic
and edimax header model into a shared build recipe.
Signed-off-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[drop duplicate TARGET_DEVICES, add EDIMAX_* to DEVICE_VARS, edit title]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
This device is the non-US build of the F9K1115 v2, with a different
firmware magic.
Specifications:
SoC: QCA9558
CPU: 720 MHz
Flash: 16 MiB NOR
RAM: 128 MiB
WiFi 2.4 GHz: QCA9558-AT4A 3x3 MIMO 802.11b/g/n
WiFi 5 GHz: QCA9880-2R4E 3x3 MIMO 802.11a/n/ac
Ethernet: 4x LAN and 1x WAN (all 1gbps)
USB: 1 x USB 2.0 (lower), 1 x USB 3.0 (upper)
MAC addresses based on OEM firmware:
Interface Address Location
--------- ------- --------
lan *:5A sometimes in 0x6
wan *:5B 0x0
2.4Ghz *:5A 0x1002
5Ghz As per mini PCIe EEPROM
Flashing instructions:
The factory.bin can be flashed via the Belkin web UI or via the uboot
http upgrade page.
Once the factory.bin has been written, sysupgrade.bin will work as usual.
Signed-off-by: Damien Mascord <tusker@tusker.org>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
[wrap commit message/code, adjust label-mac-device, whitespace fixes,
merge block in 02_network]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Because the bug described in FS#2428 has been fixed with bf2870c1d9
("kernel: fix mtd partition erase < parent_erasesize writes") these
devices can now safely do sysupgrade.
Restore sysupgrade support disabled in:
0cc87b3bac ("ath79: image: disable sysupgrade images for routerstations
and ja76pf2")
cc5256a8bf ("ath79: base-files: disable sysupgrade for routerstations
and ja76pf2")
Signed-off-by: Tomasz Maciej Nowak <tmn505@gmail.com>
[move Build block, remove check-size argument, wrap sysupgrade line,
make commit message easier to read]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Replace NETGEAR_KERNEL_MAGIC by UIMAGE_MAGIC to better match the
variable's purpose. This allows to drop the custom
Build/netgear-uImage.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
[keep UIMAGE_MAGIC definitions even for default value]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
FCC ID: A8J-EAP300A
Engenius EAP300 v2 is an indoor wireless access point with a
100/10-BaseT ethernet port, 2.4 GHz wireless, internal antennas,
and 802.3af PoE.
**Specification:**
- AR9341
- 40 MHz reference clock
- 16 MB FLASH MX25L12845EMI-10G
- 64 MB RAM
- UART at J1 (populated)
- Ethernet port with POE
- internal antennas
- 3 LEDs, 1 button (power, eth, wlan) (reset)
**MAC addresses:**
phy0 *:d3 art 0x1002 (label)
eth0 *:d4 art 0x0/0x6
**Installation:**
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
Navigate to "Firmware" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt uboot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
**Return to OEM:**
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
**TFTP recovery** (unstable / not reliable):
rename initramfs to 'vmlinux-art-ramdisk'
make available on TFTP server at 192.168.1.101
power board while holding or pressing reset button repeatedly
NOTE: for some Engenius boards TFTP is not reliable
try setting MTU to 600 and try many times
**Format of OEM firmware image:**
The OEM software of EAP300 v2 is a heavily modified version
of Openwrt Kamikaze. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring.
The OEM upgrade script is at /etc/fwupgrade.sh.
OKLI kernel loader is required because the OEM software
expects the kernel size to be no greater than 1536k
and otherwise the factory.bin upgrade procedure would
overwrite part of the kernel when writing rootfs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
[clarify MAC address section, bump PKG_RELEASE for uboot-envtools]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
ALFA Network Pi-WiFi4 is a Qualcomm QCA9531 v2 based, high-power 802.11n
WiFi board in Raspberry Pi 3B shape, equipped with 1x FE and 4x USB 2.0.
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16+ MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 4x USB 2.0 Type-A
- Genesys Logic GL850G 4-port USB HUB
- USB power is controlled by GPIO
- 5x LED (3x on PCB, 2x in RJ45, 4x driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- 1x micro USB Type-B for power and system console (Holtek HT42B534)
- UART and GPIO (8-pin, 1.27 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
E600G v2 based on Qualcomm/Atheros QCA9531
Specification:
- 650/600/200 MHz (CPU/DDR/AHB)
- 128/64 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz
- 2 x 10/100 Mbps Ethernet(RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 5 x LED , 1 x Button(SW2-Reset Buttun), 1 x power input
- UART(J100) header on PCB(115200 8N1)
E600GAC v2 based on Qualcomm/Atheros QCA9531 + QCA9887
Specification:
- 650/600/200 MHz (CPU/DDR/AHB)
- 128/64 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz
- 1T1R 5 GHz
- 2 x 10/100 Mbps Ethernet(RJ45)
- 6 x LED (one three-color led), 2 x Button(SW2-Reset Buttun),1 x power input
- UART (J100)header on PCB(115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original OpenWrt image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ath79-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to OpenWrt:
run lfw
- After that the device will reboot and boot to OpenWrt.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original OpenWrt image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ath79-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to OpenWrt.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[rearrange in generic.mk, fix one case in 04_led_migration, update
commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Use the default sysupgrade generation procedure provided
by the target. The previously generated images had the rootfs not
aligned to an eraseblock.
Signed-off-by: David Bauer <mail@david-bauer.net>
This supports upgrade from ar71xx for the recently added Qxwlan
devices E1700AC v2, E558 v2, E750A v4 and E750G v8.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
E1700AC v2 based on Qualcomm/Atheros QCA9563 + QCA9880.
Specification:
- 750/400/250 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 3T3R 2.4 GHz
- 3T3R 5 GHz
- 2 x 10/1000M Mbps Ethernet (RJ45)
- 1 x MiniPCI-e
- 1 x SIM (3G/4G)
- 1 x USB 2.0 Port
- 5 x LED , 2 x Button(S8-Reset Buttun), 1 x power input
- UART (J5) header on PCB (115200 8N1)
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace fixes]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Qxwlan E558 v2 is based on Qualcomm QCA9558 + AR8327.
Specification:
- 720/600/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4 GHz (QCA9558)
- 3x 10/100/1000 Mbps Ethernet (one port with PoE support)
- 4x miniPCIe slot (USB 2.0 bus only)
- 1x microSIM slot
- 5x LED (4 driven by GPIO)
- 1x button (reset)
- 1x 3-pos switch
- 1x DC jack for main power input (9-48 V)
- UART (JP5) and LEDs (J8) headers on PCB
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig, whitespace adjustments]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Qxwlan E750G v8 is based on Qualcomm QCA9344 + QCA9334.
Specification:
- 560/450/225 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 2.4G GHz (AR9344)
- 2x 10/100/1000 Mbps Ethernet (one port with PoE support)
- 7x LED (6 driven by GPIO)
- 1x button (reset)
- 1x DC jack for main power input (9-48 V)
- UART (J23) and LEDs (J2) headers on PCB
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: 张鹏 <sd20@qxwlan.com>
[cut out of bigger patch, keep swconfig]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Qxwlan E750A v4 is based on Qualcomm QCA9344.
Specification:
- 560/450/225 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 8/16 MB of FLASH (SPI NOR)
- 2T2R 5G GHz (AR9344)
- 2x 10/100 Mbps Ethernet (one port with PoE support)
- 1x miniPCIe slot (USB 2.0 bus only)
- 7x LED (6 driven by GPIO)
- 1x button (reset)
- 1x DC jack for main power input (9-48 V)
- UART (J23) and LEDs (J2) headers on PCB
Flash instruction:
1.Using tftp mode with UART connection and original LEDE image
- Configure PC with static IP 192.168.1.10 and tftp server.
- Rename "openwrt-ar71xx-generic-xxx-squashfs-sysupgrade.bin"
to "firmware.bin" and place it in tftp server directory.
- Connect PC with one of LAN ports, power up the router and press
key "Enter" to access U-Boot CLI.
- Use the following commands to update the device to LEDE:
run lfw
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
2.Using httpd mode with Web UI connection and original LEDE image
- Configure PC with static IP 192.168.1.xxx(2-255) and tftp server.
- Connect PC with one of LAN ports,press the reset button, power up
the router and keep button pressed for around 6-7 seconds, until
leds flashing.
- Open your browser and enter 192.168.1.1,You will see the upgrade
interface, select "openwrt-ar71xx-generic-xxx-squashfs-
sysupgrade.bin" and click the upgrade button.
- After that the device will reboot and boot to LEDE.
- Wait until all LEDs stops flashing and use the router.
Signed-off-by: Peng Zhang <sd20@qxwlan.com>
[cut out of bigger patch, alter use of DEVICE_VARIANT, merge case
in 01_leds, use lower case for v4]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Hak5 WiFi Pineapple NANO is an "USB dongle" device dedicated for Wi-Fi
pentesters. This device is based on Atheros AR9331 and AR9271. Support
for it was first introduced in 950b278c81 (ar71xx). FCC ID: 2AB87-NANO.
Specifications:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of flash (SPI NOR)
- 1T1R 2.4 GHz Wi-Fi (AR9331)
- 1T1R 2.4 GHz Wi-Fi (AR9271L), with ext. PA and LNA (Qorvo RFFM4203)
- 2x RP-SMA antenna connectors
- 1x USB 2.0 to 10/100 Ethernet bridge (ASIX AX88772A)
- integrated 4-port USB 2.0 HUB: Alcor Micro AU6259:
- 1x USB 2.0
- 1x microSD card reader (Genesys Logic GL834L)
- Atheros AR9271L
- 1x LED, 1x button
- UART (4-pin, 2 mm pitch) header on PCB
- USB 2.0 Type-A plug for power and AX88772A
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Hak5 Packet Squirrel is a pocket-sized device dedicated for pentesters
(MITM attacks). This device is based on Atheros AR9331 but it lacks
WiFi. Support for it was first introduced in 950b278c81 (ar71xx).
Specifications:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x RJ45 10/100 Mbps Ethernet (AR9331)
- 1x USB 2.0
- 1x RGB LED, 1x button, 1x 4-way mechanical switch
- 1x Micro USB Type-B for main power input
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Hak5 LAN Turtle is an "USB Ethernet Adapter" shaped device dedicated for
sysadmins and pentesters. This device is based on Atheros AR9331 but it
lacks WiFi. Support for it was first introduced in 950b278c81 (ar71xx).
Two different versions of this device exist and it's up to the user to
install required drivers (generic image supports only common features):
- LAN Turtle 3G with Quectel UG96 3G modem
- LAN Turtle SD with microSD card reader (Alcorlink AU6435R)
Specifications:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 1x RJ45 10/100 Mbps Ethernet (AR9331)
- 1x USB 2.0 to 10/100 Ethernet bridge (Realtek RTL8152B)
- 2x LED (power, system), 1x button (inside, on the PCB)
- USB 2.0 Type-A plug for power and RTL8152B
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network N5Q is a successor of previous model, the N5 (outdoor
CPE/AP, based on Atheros AR7240 + AR9280). New version is based on
Atheros AR9344.
Support for this device was first introduced in 4b0eebe9df (ar71xx
target) but users are advised to migrate from ar71xx target without
preserving settings as ath79 support includes some changes in network
and LED default configuration. They were aligned with vendor firmware
and recently added N2Q model (both Ethernet ports as LAN, labelled as
LAN1 and LAN2).
Specifications:
- Atheros AR9344
- 550/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet, with passive PoE support (24 V)
- 2T2R 5 GHz Wi-Fi, with ext. PA (RFPA5542) and LNA, up to 27 dBm
- 2x IPEX/U.FL or MMCX antenna connectors (for PCBA version)
- 8x LED (7 are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- header for optional 802.3at/af PoE module
- DC jack for main power input (optional, not installed by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on OpenWrt/LEDE. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network N2Q is an outdoor N300 AP/CPE based on Qualcomm/Atheros
QCA9531 v2. This model is a successor of the old N2 which was based
on Atheros AR7240. FCC ID: 2AB8795311.
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2T2R 2.4 GHz Wi-Fi with ext. PA (Skyworks SE2623L) and LNA
- 2x 10/100 Mbps Ethernet with passive PoE input in one port (24 V)
- PoE pass through in second port (controlled by GPIO)
- support for optional 802.3af/at PoE module
- 1x mini PCIe slot (PCIe bus, extra 4.2 V for high power cards)
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 mini Type-B (power controlled by GPIO)
- 8x LED (7 of them are driven by GPIO)
- 1x button (reset)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- UART (4-pin, 2.54 mm pitch) header on PCB
- LEDs (2x 5-pin, 2.54 mm pitch) header on PCB
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
ALFA Network R36A is a successor of the previous model, the R36 (Ralink
RT3050F based). New version is based on Qualcomm/Atheros QCA9531 v2, FCC
ID: 2AB879531.
Support for this device was first introduced in af8f0629df (ar71xx
target). When updating from previous release (and/or ar71xx target),
user should only adjust the WAN LED trigger type (netdev in ar71xx,
switch port in ath79).
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 650/400/200 MHz (CPU/DDR/AHB)
- 128 MB (R36AH/-U2) or 64 MB (R36A) of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- Passive PoE input support (12~36 V) in RJ45 near DC jack
- 2T2R 2.4 GHz Wi-Fi with Qorvo RFFM8228P FEM
- 2x IPEX/U.FL connectors on PCB
- 1x USB 2.0 Type-A
- 1x USB 2.0 mini Type-B in R36AH-U2 version
- USB power is controlled by GPIO
- 6/7x LED (5/6 of them are driven by GPIO)
- 2x button (reset, wifi/wps)
- external h/w watchdog (EM6324QYSP5B, enabled by default)
- DC jack with lock, for main power input (12 V)
- UART (4-pin, 2.54 mm pitch) header on PCB
Optional/additional features in R36A series (R36A was the first model):
- for R36AH: USB 2.0 hub*
- for R36AH-U2: USB 2.0 hub*, 1x USB 2.0 mini Type-B, one more LED
*) there are at least three different USB 2.0 hub in R36AH/-U2 variants:
- Terminus-Tech FE 1.1
- Genesys Logic GL852G
- Genesys Logic GL850G (used in latests revision)
Flash instruction:
You can use sysupgrade image directly in vendor firmware which is based
on LEDE/OpenWrt. Alternatively, you can use web recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with one of RJ45 ports, press the reset button, power up
device, wait for first blink of all LEDs (indicates network setup),
then keep button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Samsung WAM250 is a dual-band (selectable, not simultaneous) wireless
hub, dedicated for Samsung Shape Wireless Audio System. The device is
based on Atheros AR9344 (FCC ID: A3LWAM250). Support for this device
was first introduced in e58e49bdbe (ar71xx target).
Specifications:
- Atheros AR9344
- 560/450/225 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR2)
- 16 MB of flash (SPI NOR)
- 2x 10/100 Mbps Ethernet
- 2T2R 2.4/5 GHz Wi-Fi, with ext. PA (SE2598L, SE5003L) and LNA
- 1x USB 2.0
- 4x LED (all are driven by GPIO)
- 2x button (reset, wps/speaker add)
- DC jack for main power input (14 V)
- UART header on PCB (J4, RX: 3, TX: 5)
Flash instruction:
This device uses dual-image (switched between upgrades) with a common
jffs2 config partition. Fortunately, there is a way to disable this mode
so that more flash space can be used by OpenWrt image.
You can easily access this device over telnet, using root/root
credentials (the same also work for serial console access).
1. Make sure that your device uses second (bootpart=2) image using
command: "fw_printenv bootpart".
2. If your device uses first image (bootpart=1), perform upgrade to the
latest vendor firmware (after the update, device should boot from
second partition) using web gui (default login: admin/1234567890).
3. Rename "sysupgrade" image to "firmware.bin", download it (you can use
wget, tftp or ftpget) to "/tmp" and issue below commands:
mtd_debug erase /dev/mtd3 0 $(wc -c /tmp/firmware.bin | awk -F' ' '{print $1}')
mtd_debug write /dev/mtd3 0 $(wc -c /tmp/firmware.bin)
fw_setenv bootpart
fw_setenv bootcmd "bootm 0x9f070000"
reboot
Revert to vendor firmware instruction:
1. Download vendor firmware to "/tmp" device and issue below commands:
fw_setenv bootpart 1
sysupgrade -n -F SS_BHUB_v2.2.05.bin
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Wallys DR531 is based on Qualcomm Atheros QCA9531 v2. Support for this
device was first introduced in e767980eb8 (ar71xx target).
Specifications:
- Qualcomm/Atheros QCA9531 v2
- 550/400/200 MHz (CPU/DDR/AHB)
- 2x 10/100 Mbps Ethernet
- 64 MB of RAM (DDR2)
- 8 MB of flash (SPI NOR)
- 2T2R 2.4 GHz Wi-Fi, with external PA (SE2576L), up to 30 dBm
- 2x MMCX connectors (optional IPEX/U.FL)
- mini PCIe connector (PCIe/USB buses and mini SIM slot)
- 7x LED, 1x button, 1x optional buzzer
- UART, JTAG and LED headers on PCB
Flash instruction (do it under U-Boot, using UART):
tftpb 0x80060000 openwrt-ath79-...-dr531-squashfs-sysupgrade.bin
erase 0x9f050000 +$filesize
cp.b $fileaddr 0x9f050000 $filesize
setenv bootcmd "bootm 0x9f050000"
saveenv && reset
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
The AP121FE is a slightly modified version of already supported AP121F
model (added to ar71xx in 0c6165d21a and to ath79 in 334bbc5198).
The differences in compare to AP121F:
- no micro SD card reader
- USB data lines are included in Type-A plug
- USB bus switched to device/peripheral mode (permanently, in bootstrap)
Other than that, specifications are the same:
- Atheros AR9331
- 400/400/200 MHz (CPU/DDR/AHB)
- 64 MB of RAM (DDR1)
- 16 MB of flash (SPI NOR)
- 1x 10/100 Mbps Ethernet
- 1T1R 2.4 GHz Wi-Fi, up to 15 dBm
- 1x IPEX/U.FL connector, internal PCB antenna
- 3x LED, 1x button, 1x switch
- 4-pin UART header on PCB (2 mm pitch)
- USB 2.0 Type-A plug (power and data)
Flash instruction (under U-Boot web recovery mode):
1. Configure PC with static IP 192.168.1.2/24.
2. Connect PC with RJ45 port, press the reset button, power up device,
wait for first blink of all LEDs (indicates network setup), then keep
button for 3 following blinks and release it.
3. Open 192.168.1.1 address in your browser and upload sysupgrade image.
Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
Move engenius_loader_okli image recipe in front of all Engenius
devices, so adding new device entries will not have them sorted
before the shared recipe.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The hardware of this device seems to be identical to WZR-HP-AG300H.
It was already implemented as a clone in ar71xx.
Specification:
- 680 MHz CPU (Qualcomm Atheros AR7161)
- 128 MiB RAM
- 32 MiB Flash
- WiFi 5 GHz a/n
- WiFi 2.4 GHz b/g/n
- 5x 1000Base-T Ethernet
- 1x USB 2.0
Installation of OpenWRT from vendor firmware:
- Connect to the Web-interface at http://192.168.11.1
- Go to “Administration” → “Firmware Upgrade”
- Upload the OpenWrt factory image
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The Buffalo devices in ath79 share their image generation code,
so let's create a shared Device definition for them.
Since most of them use BUFFALO_HWVER := 3, this is moved as
default to the shared definition as well.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
FCC ID: U2M-ENH200
Engenius ENH202 is an outdoor wireless access point with 2 10/100 ports,
built-in ethernet switch, internal antenna plates and proprietery PoE.
Specification:
- Qualcomm/Atheros AR7240 rev 2
- 40 MHz reference clock
- 8 MB FLASH ST25P64V6P (aka ST M25P64)
- 32 MB RAM
- UART at J3 (populated)
- 2x 10/100 Mbps Ethernet (built-in switch at gmac1)
- 2.4 GHz, 2x2, 29dBm (Atheros AR9280 rev 2)
- internal antenna plates (10 dbi, semi-directional)
- 5 LEDs, 1 button (LAN, WAN, RSSI) (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Power LED not controllable, or unknown gpio
MAC addresses:
eth0/eth1 *:11 art 0x0/0x6
wlan *:10 art 0x120c
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop or halt which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9f670000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to Engenius boards.
If the failsafe image is missing or damaged this will not work
DO NOT downgrade to ar71xx this way, can cause kernel loop or halt
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
Format of OEM firmware image:
The OEM software of ENH202 is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-enh202-uImage-lzma.bin
openwrt-senao-enh202-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
OKLI kernel loader is required because the OEM firmware
expects the kernel to be no greater than 1024k
and the factory.bin upgrade procedure would otherwise
overwrite part of the kernel when writing rootfs.
Note on built-in switch:
ENH202 is originally configured to be an access point,
but with two ethernet ports, both WAN and LAN is possible.
the POE port is gmac0 which is preferred to be
the port for WAN because it gives link status
where swconfig does not.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[assign label_mac in 02_network, use ucidef_set_interface_wan,
use common device definition, some reordering]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Engenius ENS202EXT v1 is an outdoor wireless access point with 2 10/100 ports,
with built-in ethernet switch, detachable antennas and proprietery PoE.
FCC ID: A8J-ENS202
Specification:
- Qualcomm/Atheros AR9341 v1
- 535/400/200/40 MHz (CPU/DDR/AHB/REF)
- 64 MB of RAM
- 16 MB of FLASH MX25L12835F(MI-10G)
- UART (J1) header on PCB (unpopulated)
- 2x 10/100 Mbps Ethernet (built-in switch Atheros AR8229)
- 2.4 GHz, up to 27dBm (Atheros AR9340)
- 2x external, detachable antennas
- 7x LED (5 programmable in ath79), 1x GPIO button (Reset)
Known Issues:
- Sysupgrade from ar71xx no longer possible
- Ethernet LEDs stay on solid when connected, not programmable
MAC addresses:
eth0/eth1 *:7b art 0x0/0x6
wlan *:7a art 0x1002
The device label lists both addresses, WLAN MAC and ETH MAC,
in that order.
Since 0x0 and 0x6 have the same content, it cannot be
determined which is eth0 and eth1, so we chose 0x0 for both.
Installation:
2 ways to flash factory.bin from OEM:
- Connect ethernet directly to board (the non POE port)
this is LAN for all images
- if you get Failsafe Mode from failed flash:
only use it to flash Original firmware from Engenius
or risk kernel loop which requires serial cable
Method 1: Firmware upgrade page:
OEM webpage at 192.168.1.1
username and password "admin"
In upper right select Reset
"Restore to factory default settings"
Wait for reboot and login again
Navigate to "Firmware Upgrade" page from left pane
Click Browse and select the factory.bin image
Upload and verify checksum
Click Continue to confirm and wait 3 minutes
Method 2: Serial to load Failsafe webpage:
After connecting to serial console and rebooting...
Interrupt boot with any key pressed rapidly
execute `run failsafe_boot` OR `bootm 0x9fdf0000`
wait a minute
connect to ethernet and navigate to
"192.168.1.1/index.htm"
Select the factory.bin image and upload
wait about 3 minutes
*If you are unable to get network/LuCI after flashing*
You must perform another factory reset:
After waiting 3 minutes or when Power LED stop blinking:
Hold Reset button for 15 seconds while powered on
or until Power LED blinks very fast
release and wait 2 minutes
Return to OEM:
If you have a serial cable, see Serial Failsafe instructions
*DISCLAIMER*
The Failsafe image is unique to this model.
The following directions are unique to this model.
DO NOT downgrade to ar71xx this way, can cause kernel loop
The easiest way to return to the OEM software is the Failsafe image
If you dont have a serial cable, you can ssh into openwrt and run
`mtd -r erase fakeroot`
Wait 3 minutes
connect to ethernet and navigate to 192.168.1.1/index.htm
select OEM firmware image from Engenius and click upgrade
TFTP Recovery:
For some reason, TFTP is not reliable on this board.
Takes many attempts, many timeouts before it fully transfers.
Starting with an initramfs.bin:
Connect to ethernet
set IP address and TFTP server to 192.168.1.101
set up infinite ping to 192.168.1.1
rename the initramfs.bin to "vmlinux-art-ramdisk" and host on TFTP server
disconnect power to the board
hold reset button while powering on board for 8 seconds
Wait a minute, power LED should blink eventually if successful
and a minute after that the pings should get replies
You have now loaded a temporary Openwrt with default settings temporarily.
You can use that image to sysupgrade another image to overwrite flash.
Format of OEM firmware image:
The OEM software of ENS202EXT is a heavily modified version
of Openwrt Kamikaze bleeding-edge. One of the many modifications
is to the sysupgrade program. Image verification is performed
simply by the successful ungzip and untar of the supplied file
and name check and header verification of the resulting contents.
To form a factory.bin that is accepted by OEM Openwrt build,
the kernel and rootfs must have specific names...
openwrt-senao-ens202ext-uImage-lzma.bin
openwrt-senao-ens202ext-root.squashfs
and begin with the respective headers (uImage, squashfs).
Then the files must be tarballed and gzipped.
The resulting binary is actually a tar.gz file in disguise.
This can be verified by using binwalk on the OEM firmware images,
ungzipping then untaring, and by swapping headers to see
what the OEM upgrade utility accepts and rejects.
Note on the factory.bin:
The newest kernel is too large to be in the kernel partition
the new ath79 kernel is beyond 1592k
Even ath79-tiny is 1580k
Checksum fails at boot because the bootloader (modified uboot)
expects kernel to be 1536k. If the kernel is larger, it gets
overwritten when rootfs is flashed, causing a broken image.
The mtdparts variable is part of the build and saving a new
uboot environment will not persist after flashing.
OEM version might interact with uboot or with the custom
OEM partition at 0x9f050000.
Failed checksums at boot cause failsafe image to launch,
allowing any image to be flashed again.
HOWEVER: one should not install older Openwrt from failsafe
because it can cause rootfs to be unmountable,
causing kernel loop after successful checksum.
The only way to rescue after that is with a serial cable.
For these reasons, a fake kernel (OKLI kernel loader)
and fake squashfs rootfs is implemented to take care of
the OEM firmware image verification and checksums at boot.
The OEM only verifies the checksum of the first image
of each partition respectively, which is the loader
and the fake squashfs. This completely frees
the "firmware" partition from all checks.
virtual_flash is implemented to make use of the wasted space.
this leaves only 2 erase blocks actually wasted.
The loader and fakeroot partitions must remain intact, otherwise
the next boot will fail, redirecting to the Failsafe image.
Because the partition table required is so different
than the OEM partition table and ar71xx partition table,
sysupgrades are not possible until one switches to ath79 kernel.
Note on sysupgrade.tgz:
To make things even more complicated, another change is needed to
fix an issue where network does not work after flashing from either
OEM software or Failsafe image, which implants the OEM (Openwrt Kamikaze)
configuration into the jffs2 /overlay when writing rootfs from factory.bin.
The upgrade script has this:
mtd -j "/tmp/_sys/sysupgrade.tgz" write "${rootfs}" "rootfs"
However, it also accepts scripts before and after:
before_local="/etc/before-upgradelocal.sh"
after_local="/etc/after-upgradelocal.sh"
before="before-upgrade.sh"
after="after-upgrade.sh"
Thus, we can solve the issue by making the .tgz an empty file
by making a before-upgrade.sh in the factory.bin
Note on built-in switch:
There is two ports on the board, POE through the power supply brick,
the other is on the board. For whatever reason, in the ar71xx target,
both ports were on the built-in switch on eth1. In order to make use
of a port for WAN or a different LAN, one has to set up VLANs.
In ath79, eth0 and eth1 is defined in the DTS so that the
built-in switch is seen as eth0, but only for 1 port
the other port is on eth1 without a built-in switch.
eth0: switch0
CPU is port 0
board port is port 1
eth1: POE port on the power brick
Since there is two physical ports,
it can be configured as a full router,
with LAN for both wired and wireless.
According to the Datasheet, the port that is not on the switch
is connected to gmac0. It is preferred that gmac0 is chosen as WAN
over a port on an internal switch, so that link status can pass
to the kernel immediately which is more important for WAN connections.
Signed-off-by: Michael Pratt <mpratt51@gmail.com>
[apply sorting in 01_leds, make factory recipe more generic, create common
device node, move label-mac to 02_network, add MAC addresses to commit
message, remove kmod-leds-gpio, use gzip directly]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Port device support for Meraki MR16 from the ar71xx target to ath79.
Specifications:
* AR7161 CPU, 16 MiB Flash, 64 MiB RAM
* One PoE-capable Gigabit Ethernet Port
* AR9220 / AR9223 (2x2 11an / 11n) WLAN
Installation:
* Requires TFTP server at 192.168.1.101, w/ initramfs & sysupgrade .bins
* Open shell case and connect a USB to TTL cable to upper serial headers
* Power on the router; connect to U-boot over 115200-baud connection
* Interrupt U-boot process to boot Openwrt by running:
setenv bootcmd bootm 0xbf0a0000; saveenv;
tftpboot 0c00000 <filename-of-initramfs-kernel>.bin;
bootm 0c00000;
* Copy sysupgrade image to /tmp on MR16
* sysupgrade /tmp/<filename-of-sysupgrade>.bin
Notes:
- There are two separate ARTs in the partition (offset 0x1000/0x5000 and
0x11000/0x15000) in the OEM device. I suspect this is an OEM artifact;
possibly used to configure the radios for different regions,
circumstances or RF frontends. Since the ar71xx target uses the
second offsets, use that second set (0x11000 and 0x15000) for the ART.
- kmod-owl-loader is still required to load the ART partition into the
driver.
- The manner of storing MAC addresses is updated from ar71xx; it is
at 0x66 of the 'config' partition, where it was discovered that the
OEM firmware stores it. This is set as read-only. If you are
migrating from ar71xx and used the method mentioned above to
upgrade, use kmod-mtd-rw or UCI to add the MAC back in. One more
method for doing this is described below.
- Migrating directly from ar71xx has not been thoroughly tested, but
one method has been used a couple of times with good success,
migrating 18.06.2 to a full image produced as of this commit. Please
note that these instructions are only for experienced users, and/or
those still able to open their device up to flash it via the serial
headers should anything go wrong.
1) Install kmod-mtd-rw and uboot-envtools
2) Run `insmod mtd-rw.ko i_want_a_brick=1`
3) Modify /etc/fw_env.config to point to the u-boot-env partition.
The file /etc/fw_env.config should contain:
# MTD device env offset env size sector size
/dev/mtd1 0x00000 0x10000 0x10000
See https://openwrt.org/docs/techref/bootloader/uboot.config
for more details.
4) Run `fw_printenv` to verify everything is correct, as per the
link above.
5) Run `fw_setenv bootcmd bootm 0xbf0a0000` to set a new boot address.
6) Manually modify /lib/upgrade/common.sh's get_image function:
Change ...
cat "$from" 2>/dev/null | $cmd
... into ...
(
dd if=/dev/zero bs=1 count=$((0x66)) ; # Pad the first 102 bytes
echo -ne '\x00\x18\x0a\x12\x34\x56' ; # Add in MAC address
dd if=/dev/zero bs=1 count=$((0x20000-0x66-0x6)) ; # Pad the rest
cat "$from" 2>/dev/null | $cmd
)
... which, during the upgrade process, will pad the image by
128K of zeroes-plus-MAC-address, in order for the ar71xx's
firmware partition -- which starts at 0xbf080000 -- to be
instead aligned with the ath79 firmware partition, which
starts 128K later at 0xbf0a0000.
7) Copy the sysupgrade image into /tmp, as above
8) Run `sysupgrade -F /tmp/<sysupgrade>.bin`, then wait
Again, this may BRICK YOUR DEVICE, so make *sure* to have your
serial cable handy.
Addenda:
- The MR12 should be able to be migrated in a nearly identical manner as
it shares much of its hardware with the MR16.
- Thank-you Chris B for copious help with this port.
Signed-off-by: Martin Kennedy <hurricos@gmail.com>
[fix typo in compat message, drop art DT label,
move 05_fix-compat-version to subtarget]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
In order to support SAE/WPA3-Personal in default images. Replace almost
all occurencies of wpad-basic and wpad-mini with wpad-basic-wolfssl for
consistency. Keep out ar71xx from the list as it won't be in the next
release and would only make backports harder.
Build-tested (build-bot settings):
ath79: generic, ramips: mt7620/mt76x8/rt305x, lantiq: xrx200/xway,
sunxi: a53
Signed-off-by: Petr Štetiar <ynezz@true.cz>
[rebase, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
ALLNET ALL-WAP02860AC is a dual-band wireless access point.
Specification
SoC: Qualcomm Atheros QCA9558
RAM: 128 MB DDR2
Flash: 16 MB SPI NOR
WIFI: 2.4 GHz 3T3R integrated
5 GHz 3T3R QCA9880 Mini PCIe card
Ethernet: 1x 10/100/1000 Mbps AR8035-A, PoE capable (802.3at)
LEDS: 5x, which four are GPIO controlled
Buttons: 1x GPIO controlled
UART: 4 pin header near Mini PCIe card, starting count from white
triangle on PCB
1. VCC 3.3V, 2. GND, 3. TX, 4. RX
baud: 115200, parity: none, flow control: none
MAC addresses
Calibration data does not contain valid MAC addresses.
The calculated MAC addresses are chosen in accordance with OEM firmware.
Because of:
a) constrained environment (SNMP) when connecting through Telnet
or SSH,
b) hard-coded kernel and rootfs sizes,
c) checksum verification of kerenel and rootfs images in bootloder,
creating factory image accepted by OEM web interface is difficult,
therefore, to install OpenWrt on this device UART connection is needed.
The teardown is simple, unscrew four screws to disassemble the casing,
plus two screws to separate mainboard from the casing.
Before flashing, be sure to have a copy of factory firmware, in case You
wish to revert to original firmware.
Installation
1. Prepare TFTP server with OpenWrt initramfs-kernel image.
2. Connect to LAN port.
3. Connect to UART port.
4. Power on the device and when prompted to stop autoboot, hit any key.
5. Alter U-Boot environment with following commands:
setenv failsafe_boot bootm 0x9f0a0000
saveenv
6. Adjust "ipaddr" and "serverip" addresses in U-Boot environment, use
'setenv' to do that, then run following commands:
tftpboot 0x81000000 <openwrt_initramfs-kernel_image_name>
bootm 0x81000000
7. Wait about 1 minute for OpenWrt to boot.
8. Transfer OpenWrt sysupgrade image to /tmp directory and flash it
with:
sysupgrade -n /tmp/<openwrt_sysupgrade_image_name>
9. After flashing, the access point will reboot to OpenWrt. Wait few
minutes, until the Power LED stops blinking, then it's ready for
configuration.
Signed-off-by: Tomasz Maciej Nowak <tomek_n@o2.pl>
[add MAC address comment to commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
SoC: Qualcomm Atheros QCA9557
RAM: 128 MB (Nanya NT5TU32M16EG-AC)
Flash: 16 MB (Macronix MX25L12845EMI-10G)
Ethernet: 5x 10/100/1000 (1x WAN, 4x LAN)
Wireless: QCA9557 2.4GHz (nbg), QCA9882 5GHz (ac)
USB: 2x USB 2.0 port
Buttons: 1x Reset
Switches: 1x Wifi
LEDs: 11 (Pwr, WAN, 4x LAN, 2x Wifi, 2x USB, WPS)
MAC addresses:
WAN *:3f uboot-env ethaddr + 3
LAN *:3e uboot-env ethaddr + 2
2.4GHz *:3c uboot-env ethaddr
5GHz *:3d uboot-env ethaddr + 1
The label contains all four MAC addresses, however the one without
increment is first, so this one is taken for label MAC address.
Notes:
The Wifi is controlled by an on/off button, i.e. has to be implemented
by a switch (EV_SW). Despite, it appears that GPIO_ACTIVE_HIGH needs
to be used, just like recently fixed for the NBG6716.
Both parameters have been wrong at ar71xx.
Flash Instructions:
At first the U-Boot variables need to be changed in order to boot the
new combined image format. ZyXEL uses a split kernel + root setup and
the current kernel is too large to fit into the partition. As resizing
didnt do the trick, I've decided to use the prefered combined image
approach to be future-kernel-enlargement-proof (thanks to blocktrron for
the assistance).
First add a new variable called boot_openwrt:
setenv boot_openwrt bootm 0x9F120000
After that overwrite the bootcmd and save the environment:
setenv bootcmd run boot_openwrt
saveenv
After that you can flash the openwrt factory image via TFTP. The servers
IP has to be 192.168.1.33. Connect to one of the LAN ports and hold the
WPS Button while booting. After a few seconds the NBG6616 will look for
a image file called 'ras.bin' and flash it.
Return to vendor firmware is possible by resetting the bootcmd:
setenv bootcmd run boot_flash
saveenv
and flashing the vendor image via the TFTP method as described above.
Accessing the U-Boot Shell:
ZyXEL uses a proprietary loader/shell on top of u-boot: "ZyXEL zloader v2.02"
When the device is starting up, the user can enter the the loader shell
by simply pressing a key within the 3 seconds once the following string
appears on the serial console:
| Hit any key to stop autoboot: 3
The user is then dropped to a locked shell.
| NBG6616> ?
| ATEN x,(y) set BootExtension Debug Flag (y=password)
| ATSE x show the seed of password generator
| ATSH dump manufacturer related data in ROM
| ATRT (x,y,z,u) ATRT RAM read/write test (x=level, y=start addr, z=end addr, u=iterations
| ATGO boot up whole system
| ATUR x upgrade RAS image (filename)
In order to escape/unlock a password challenge has to be passed.
Note: the value is dynamic! you have to calculate your own!
First use ATSE $MODELNAME (MODELNAME is the hostname in u-boot env)
to get the challange value/seed.
| NBG6616> ATSE NBG6616
| 00C91D7EAC3C
This seed/value can be converted to the password with the help of this
bash script (Thanks to http://www.adslayuda.com/Zyxel650-9.html authors):
- tool.sh -
ror32() {
echo $(( ($1 >> $2) | (($1 << (32 - $2) & (2**32-1)) ) ))
}
v="0x$1"
a="0x${v:2:6}"
b=$(( $a + 0x10F0A563))
c=$(( 0x${v:12:14} & 7 ))
p=$(( $(ror32 $b $c) ^ $a ))
printf "ATEN 1,%X\n" $p
- end of tool.sh -
| # bash ./tool.sh 00C91D7EAC3C
| ATEN 1,10FDFF5
Copy and paste the result into the shell to unlock zloader.
| NBG6616> ATEN 1,10FDFF5
If the entered code was correct the shell will change to
use the ATGU command to enter the real u-boot shell.
| NBG6616> ATGU
| NBG6616#
Signed-off-by: Christoph Krapp <achterin@googlemail.com>
[move keys to DTSI, adjust usb_power DT label, remove kernel config
change, extend commit message]
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
A bunch of kernel modules depends on kmod-usb-net, but does not
select it. Make AddDepends/usb-net selective, so we can drop
some redundant +kmod-usb-net definitions for DEVICE_PACKAGES.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
The ath79 target has CONFIG_LEDS_GPIO=y set in kernel config, so
no need to pull the kmod-leds-gpio module for specific devices.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Netgear currently has a special definition for tiny devices, which
is only used by two devices. Despite, it sets ups the IMAGE/default
definition individually for all devices, although there is actually
only one exception.
This merges the common parts into a single netgear_generic definition
(in contrast to netgear_ath79_nand), and adjusts the individual
definitions accordingly.
Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>
Specifications:
SoC: QCA9563
DRAM: 128MB DDR2
Flash: 16MB SPI-NOR
2 Gigabit ethernet ports
3×3 2.4GHz on-board radio
miniPCIe slot that supports 5GHz radio
PoE 24V passive or 36V-56V passive with optional IEEE 802.3af/at
USB 3.0 header
Installation:
To install, either start tftp in bin/targets/ath79/generic/ and use
the u-boot prompt over UART:
tftpboot 0x80500000 openwrt-ath79-generic-compex_wpj563-squashfs-sysupgrade.bin
erase 0x9f680000 +1
erase 0x9f030000 +$filesize
cp.b $fileaddr 0x9f030000 $filesize
boot
The cpximg file can be used with sysupgrade in the stock firmware (add
SSH key in luci for root access) or with the built-in cpximg loader.
The cpximg loader can be started either by holding the reset button
during power up or by entering the u-boot prompt and entering 'cpximg'.
Once it's running, a TFTP-server under 192.168.1.1 will accept the image
appropriate for the board revision that is etched on the board.
For example, if the board is labelled '7A02':
tftp -v -m binary 192.168.1.1 -c put openwrt-ath79-generic-compex_wpj563-squashfs-cpximg-7a02.bin
MAC addresses:
<&uboot 0x2e010> *:71 (label)
<&uboot 0x2e018> *:72
<&uboot 0x2e020> *:73
<&uboot 0x2e028> *:74
Only the first two are used (for ethernet), the WiFi modules have
separate (valid) addresses. The latter two addresses are not used.
Signed-off-by: Leon M. George <leon@georgemail.eu>
Port device support for DAP-1330 from the ar71xx target to ath79.
Additionally, images are generated for the European through-socket
case variant DAP-1365. Both devices run the same vendor firmware, the
only difference being the DAP_SIGNATURE field in the factory header.
The vendor's Web UI will display a model string stored in the flash.
Specifications:
* QCA9533, 8 MiB Flash, 64 MiB RAM
* One Ethernet Port (10/100)
* Wall-plug style case (DAP-1365 with additional socket)
* LED bargraph RSSI indicator
Installation:
* Web UI: http://192.168.0.50 (or different address obtained via DHCP)
There is no password set by default
* Recovery Web UI: Keep reset button pressed during power-on
until LED starts flashing red, upgrade via http://192.168.0.50
* Some modern browsers may have problems flashing via the Web UI,
if this occurs consider booting to recovery mode and flashing via:
curl -F \
files=@openwrt-ath79-generic-dlink_dap-1330-a1-squashfs-factory.bin \
http://192.168.0.50/cgi/index
The device will use the same MAC address for both wired and wireless
interfaces, however it is stored at two different locations in the flash.
Signed-off-by: Sebastian Schaper <openwrt@sebastianschaper.net>
